Instructor: Scanning Risks. 2 2
In this lesson, we're going to talk about some 3 3
of the risks associated with scanning. 4 4
Now, I've mentioned this before, but when you scan things, 5 5
you have a risk that you can actually do harm. 6 6
For example, if you're scanning some things, 7 7
you can actually crash the system, 8 8
because some of those things are exploiting vulnerabilities 9 9
that could trigger a system reboot or a system reset. 10 10
Now, where is this really going to be most common? 11 11
Well, when you're dealing with printers, VoIP phones, 12 12
or embedded systems. 13 13
These components can react unpredictably 14 14
to any type of scanning, 15 15
and so you really have a lot more chance 16 16
of resetting those things or causing it to crash 17 17
when you're doing vulnerability scans. 18 18
This again is why it is so important for you 19 19
to really scope your scans properly, 20 20
and one of the reasons why I put all my VoIP phones 21 21
on one scope and I put all my embedded systems on another 22 22
and I put my printers on yet another. 23 23
That way, I can really tailor 24 24
what vulnerabilities I'm going to scan against on those devices 25 25
and I can minimize my risk of crashing those systems. 26 26
Now, another thing you need to think about 27 27
when you start dealing with your scans 28 28
is all these scan results that come back to you. 29 29
They have a lot of great information 30 30
and we're going to start looking at those 31 31
in the next section of the course, 32 32
but these scan results need to be protected, 33 33
because they have the keys to the kingdom. 34 34
When you have those scan results, 35 35
you know exactly what vulnerabilities you have, 36 36
and if you let an attacker get those, 37 37
that gives them a blueprint of exactly how to attack you, 38 38
so you want to make sure these are protected. 39 39
Anytime you finish with a scan, 40 40
you should take those results 41 41
and you should encrypt them before storing them. 42 42
You also should place them 43 43
behind a restrictive access control list 44 44
to make sure nobody can get into those, 45 45
except the personnel who need them. 46 46
Now, when you're doing your scanning, 47 47
we talked a lot about the fact 48 48
of the credentialed versus not credentialed. 49 49
Well, if you're going to use a credentialed scan, 50 50
you need to have administrator privileges, right? 51 51
Well, not necessarily. 52 52
Instead of giving somebody local administrator privileges, 53 53
you should use a service account. 54 54
This way, you can conduct your credentialed scans 55 55
with a service account on those machines across the network, 56 56
and if you need to change the password, 57 57
it's just one service account 58 58
that goes across the entire domain, 59 59
so it's much easier for you 60 60
to change those credentials as needed. 61 61
Another thing you have to think about is ports. 62 62
If you're going to start opening ports for scanning, 63 63
this is sometimes needed, so you can actually do your scans, 64 64
but you're also increasing your network's attack surface, 65 65
because the more ports are open, 66 66
that means the more bad things can happen, 67 67
so you want to make sure you're thinking about that 68 68
and weighing those risks. 69 69
Another way that we can mitigate this 70 70
is by configuring static IP addresses. 71 71
If we configure static IP addresses for my scanning servers, 72 72
this allows me to set up the right ACLs through the firewall 73 73
and open up ports directly for those servers 74 74
and those IPs only instead of opening it up for everybody. 75 75
This can help you minimize the network attack surface. 76 76
So again, this is all about risk versus reward 77 77
and risk mitigation, 78 78
and by taking these things into account, you can make sure 79 79
that you're going to be scanning more effectively, 80 80
more efficiently, and more securely.